Every trigger evaluates to "OK"

[Adam L]

Hello, I am new to Zabbix and trying to configure what I consider to be a fairly simple trigger: It should activate if a particular string is found in a log file on the server.

In this particular case, I am testing using a test file called C:\Temp\testlog.txt which contains, among other things, the text "test".

I have created triggers to find the text "test", and also other triggers to find the text "asdfgh", which does NOT occur in the text file.

As I understand it, the find() function returns either a 1 or a 0, depending on whether it found the string or not. However, in my testing, everything just evaluates to "OK", as seen in this screenshot:



I am not sure what "OK" means. The documentation just says "This is a normal trigger status", but what does that mean here? Does that mean that it found the string, or it didn't find the string?

Clearly, the result of find() cannot be 0, 1, and 2 all at the same time. Yet regardless of what I check for, the trigger just says "OK" for everything.

So, my questions are...

1. What does "OK" mean? Does that mean that the find() function found the string, or it didn't find the string?
2. Is there any way to see what the find() function is actually outputting? "OK" is nice, but I thought it is supposed to output a 1 or a 0.
3. Have I made a mistake in the configuration of my triggers?

Thanks in advance for the help...

[Adam L]

Ah! Now I understand... You're right, I added some next text to the file, and the triggers are working now. I didn't realize that the function only checks for new text, but it makes sense not to keep triggering on old log data...

Thank you very much for your help, everyone. I think I can move on with the information that I have.

[cyber]

OK is every triggers natural state. If it would show "PROBLEM" then it has triggered.. So currently they are all waiting to be triggered... if there would be a match found...

[Adam L]

OK, thank you. That makes sense... But then the question is why all the triggers are still in their "OK" state. Because the text file definitely contains the text "test", so the triggers which check for that shouldn't remain in the "OK" state.

Is there any way of seeing what the find() function is actually returning? Becaue if it's not 0, 1, or 2, then I really don't know what else it could be.

[ISiroshtan]

Did you append fresh text to log file after adding triggers? I somehow have a gut feeling you did not...

Two concept to understand:
Triggers in Zabbix (for most cases) are re-evaluated when fresh data for item is received.
Zabbix log items don't re-read full log file, they read only from place where it ended last time.

So if you added items for reading log files -> it read your log file -> you added trigger -> it will not fire, because no new values were received because no new log entries were added to log file.
Append new data to your log file and wait till Zabbix agents reads it and sends to Zabbix. Then you can check if triggers did fire as you expect them to.

[Adam L]

Ah! Now I understand... You're right, I added some next text to the file, and the triggers are working now. I didn't realize that the function only checks for new text, but it makes sense not to keep triggering on old log data...

Thank you very much for your help, everyone. I think I can move on with the information that I have.